PHP Taint — An Extension for Detecting XSS/SQL/Shell Injection Vulnerabilities中文EN

Previously, 小顿 and I talked about an idea: to analyze from the PHP language level and find some possible injection-vulnerability code. At the time, I had no time, and I genuinely didn't know where to start..
Until last week, when I saw this RFC: RFC:Taint.
But the problem with this RFC is that it requires patching PHP, modifying PHP's own data structures. That's very inconvenient for future maintenance and upgrading of PHP, and also carries some latent risks.
Even so, this RFC gave me an inspiration, so I went and built this kind of extension: Taint Extension
This extension is simple to use (currently only supports 5.2.6 to 5.3, and PHP 7 and above):
After downloading the source code, compile and install it. Then you need to enable this extension in php.ini (it's recommended NOT to enable this extension in production):

extension=taint.so
taint.enable=1

Once this extension is enabled, if in some key functions (or statements: echo, print, system, exec, etc.), or at output locations, you *directly* (without escaping or safe-filter processing) use data that comes from $_GET, $_POST or $_COOKIE, then Taint will warn you:

<?php
 $a = $_GET['a'];
 $file_name = '/tmp' .  $a;
 $output    = "Welcome, {$a} !!!";
 $var       = "output";
 $sql       = "Select *  from " . $a;
 $sql      .= "ooxx";
 echo $output;
//Warning: main(): Attempt to echo a string which might be tainted in xxx.php on line x
 print $$var;
//Warning: main(): Attempt to print a string which might be tainted  in xxx.php on line x
 include($file_name);
//Warning: include() [function.include]: File path contains data that might be tainted in xxx.php on x
 mysql_query($sql);
//Warning: mysql_query() [function.mysql-query]: First argument contains data that might be tainted in xxx.php on line x
?>

Currently, because 5.4 is not yet supported (the 5.4 implementation approach depends on a new requirement I'm about to discuss with Dmitry), no downloadable package has been released yet. Everyone can just download directly from source for now: Taint on Github.
The example above shows simple usage. I'll refine the documentation later....
enjoy~